registry / @uipath/case-tool / 1.200.0

@uipath/case-tool@1.200.0

⚠ Under review

Manage Case Management instances, processes, and incidents.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 44 file(s), 4.54 MB of source, external domains: cloud.uipath.com, fonts.googleapis.com, fonts.gstatic.com, json-schema.org, purl.org, raw.githubusercontent.com, schemas.microsoft.com, schemas.openxmlformats.org, serverlessworkflow.io, www.w3.org

Oversized source lightweight scan

dist/packager-tool-qydvfzzb.js15.0 MB file, sampled 256 KB

FilesystemHighEntropyStringsUrlStringsjson-schema.org

Source & flagged code

3 flagged

dist/index.umd.min-drpc57vn.jsView file

Lines 1814-1854javascript

1814 constructor(e2) {

1815 var t2;

1816 let n2;

1817 this.refs = {}, this.dynamicAnchors = {}, typeof e2.schema == "object" && (n2 = e2.schema), this.schema = e2.schema, this.schemaId = e2.schemaId, this.root = e2.root || this, this.baseId = (t2 = e2.baseId) !== null && t2 !== undefined ? t2 : (0, Ze.normalizeId)(n2 == null ? undefined : n2[e2.schemaId || "$id"]), this.schemaPath = e2.schemaPath, this.localRefs = e2.localRefs, this.meta = e2.meta, this.$async = n2 == null ? undefined : n2.$async, this.refs = {};

1818 }

1819 }

1820 function et(e2) {

1821 const t2 = nt.call(this, e2);

1822 if (t2)

1823 return t2;

1824 const n2 = (0, Ze.getFullPath)(this.opts.uriResolver, e2.root.baseId), { es5: r2, lines: o2 } = this.opts.code, { ownProperties: i2 } = this.opts, a2 =

1825 let s2;

1826 e2.$async && (s2 = a2.scopeValue("Error", { ref: Ke.default, code: He._`require("ajv/dist/runtime/validation_error").default` }));

1827 const l2 = a2.scopeName("validate");

1828 e2.validateName = l2;

1829 const c2 = { gen: a2, allErrors: this.opts.allErrors, data: Je.default.data, parentData: Je.default.parentData, parentDataProperty: Je.default.parentDataProperty, dataNames: [Je.default.data], dataPathArr: [He.nil], dataLevel: 0, dataTypes: [], definedProperties: new Set, topSchemaRef: a2.scopeValue("schema", this.opts.code.source === true ? { ref: e2.schema, code: (0, He.stringify)(e2.schema) } : { ref: e2.schema }), validateName: l2, ValidationError: s2, schema: e2.schema, schemaEnv: e2, rootId: n2, baseId: e2.baseId ||

1830 let u2;

1831 try {

1832 this._compilations.add(e2), (0, Qe.validateFunctionCode)(c2), a2.optimize(this.opts.code.optimize);

1833 const t3 = a2.toString();

1834 u2 = `${a2.scopeRefs(Je.default.scope)}return ${t3}`, this.opts.code.process && (u2 = this.opts.code.process(u2, e2));

1835 const n3 = new Function(`${Je.default.self}`, `${Je.default.scope}`, u2)(this, this.scope.get());

1836 if (this.scope.value(l2, { ref: n3 }), n3.errors = null, n3.schema = e2.schema, n3.schemaEnv = e2, e2.$async && (n3.$async = true), this.opts.code.source === true && (n3.source = { validateName: l2, validateCode: t3, scopeValues: a2._values }), this.opts.unevaluated) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.umd.min-drpc57vn.js

1837 const { props: e3, items: t4 } = c2;

1838 n3.evaluated = { props: e3 instanceof He.Name ? undefined : e3, items: t4 instanceof He.Name ? undefined : t4, dynamicProps: e3 instanceof He.Name, dynamicItems: t4 instanceof

1839 }

1840 return e2.validate = n3, e2;

1841 } catch (t3) {

1842 throw delete e2.validate, delete e2.validateName, u2 && this.logger.error("Error compiling schema, function code:", u2), t3;

1843 } finally {

1844 this._compilations.delete(e2);

1845 }

1846 }

1847 function tt(e2) {

1848 return (0, Ze.inlineRef)(e2.schema, this.opts.inlineRefs) ? e2.schema : e2.validate ? e2 : et.call(this, e2);

1849 }

1850 function nt(e2) {

1851 for (const r2 of this._compilations)

1852 if (n2 = e2, (t2 = r2).schema === n2.schema && t2.root === n2.root && t2.baseId === n2.baseId)

1853 return r2;

1854 var t2, n2;

Long lines were clipped for display.

dist/packager-tool-qydvfzzb.jsView file

•path = dist/packager-tool-qydvfzzb.js kind = oversized_source_file sizeBytes = 15752758 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/packager-tool-qydvfzzb.jsView on unpkg

dist/packager-tool-4f38v0ry.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/packager-tool-4f38v0ry.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/index.umd.min-drpc57vn.jsView file

1834u2 = `${a2.scopeRefs(Je.default.scope)}return ${t3}`, this.opts.code.process && (u2 = this.opts.code.process(u2, e2)); L1835: const n3 = new Function(`${Je.default.self}`, `${Je.default.scope}`, u2)(this, this.scope.get()); L1836: if (this.scope.value(l2, { ref: n3 }), n3.errors = null, n3.schema = e2.schema, n3.schemaEnv = e2, e2.$async && (n3.$async = true), this.opts.code.source === true && (n3.source = {...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.umd.min-drpc57vn.jsView on unpkg · L1834

dist/packager-tool-qydvfzzb.jsView file

•path = dist/packager-tool-qydvfzzb.js kind = oversized_source_file sizeBytes = 15752758 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/packager-tool-qydvfzzb.jsView on unpkg

dist/packager-tool-4f38v0ry.js

Findings

1 High4 Medium4 Low

HighSemantic Analysis Limiteddist/packager-tool-4f38v0ry.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/packager-tool-qydvfzzb.js

MediumStructural Risk Force Deep Review

LowEvaldist/index.umd.min-drpc57vn.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @uipath/case-tool@1.200.0.

See all versions of @uipath/case-tool for other recorded verdicts.

Review the evidence and your use of @uipath/case-tool@1.200.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 02:47:04.323Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @uipath

Behavioral surface

Related packages

More from @uipath

Source & flagged code